[henrymercer]

This PR adds the time taken to delete each version to the "Deleted the CodeQL tools" log message, and records the total time taken by the cleanup as durationMs in the codeql-action/toolcache-bundle-cleanup telemetry diagnostic so we can see how long it takes across runs.

Risk assessment

For internal use only. Please select the risk level of this change:

• Low risk: Changes are fully under feature flags, or have been fully tested and validated in pre-production environments and are highly observable, or are documentation or test only.

Which use cases does this change impact?

Workflow types:

• Advanced setup - Impacts users who have custom CodeQL workflows.
• Managed - Impacts users with dynamic workflows (Default Setup, Code Quality, ...).

Products:

• Code Scanning - The changes impact analyses when analysis-kinds: code-scanning.
• Code Quality - The changes impact analyses when analysis-kinds: code-quality.
• Other first-party - The changes impact other first-party analyses.
• Third-party analyses - The changes affect the upload-sarif action.

Environments:

• Dotcom - Impacts CodeQL workflows on github.com and/or GitHub Enterprise Cloud with Data Residency.

How did/will you validate this change?

• Unit tests - I am depending on unit test coverage (i.e. tests in .test.ts files).
• End-to-end tests - I am depending on PR checks (i.e. tests in pr-checks).

If something goes wrong after this change is released, what are the mitigation and rollback strategies?

• Rollback - Change can only be disabled by rolling back the release or releasing a new version with a fix.

How will you know if something goes wrong after this change is released?

• Telemetry - I rely on existing telemetry or have made changes to the telemetry.

Are there any special considerations for merging or releasing this change?

• No special considerations - This change can be merged at any time.

Merge / deployment checklist

• Confirm this change is backwards compatible with existing workflows.
• Consider adding a changelog entry for this change.
• Confirm the readme and docs have been updated if necessary.

[Copilot]

🟡 Changes recommended

An active finding remains because the test does not verify the new per-version deletion-duration log message or which deletion the timer covers.

1 open issue

• Add a test for the logged per-version deletion duration · New

What changed in this PR

This pull request adds observability to CodeQL toolcache cleanup by reporting deletion timing in logs and telemetry.

Changes:

• Logs the duration of each successfully deleted CodeQL toolcache version.
• Records total cleanup time as durationMs in cleanup telemetry.
• Updates unit tests and the generated JavaScript bundle.

Minor nit: add an assertion covering the per-version deletion-duration log message.

File	Summary
src/​tools-download.ts	Measures and logs the duration of each toolcache version deletion.
src/​setup-codeql.ts	Records total toolcache cleanup duration in telemetry.
src/​setup-codeql.test.ts	Verifies aggregate cleanup timing and extracts the duration diagnostic attribute.
lib/​entry-points.js	Generated JavaScript reflecting the TypeScript changes.

This pull request is ready to be approved.

_{Review effort: Lite (auto)}